CVE-2025-0141: GlobalProtect App Privilege Escalation

CVE-2025-0141 Overview

An incorrect privilege assignment vulnerability has been identified in the Palo Alto Networks GlobalProtect™ App that allows a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux systems, or to NT AUTHORITY\SYSTEM on Windows. This privilege escalation vulnerability poses significant risk to enterprise environments where GlobalProtect is deployed as the primary VPN solution.

The vulnerability is classified as CWE-426 (Untrusted Search Path), indicating the application improperly handles search paths which can be exploited by a local attacker to gain elevated privileges. Notably, the GlobalProtect app on iOS, Android, Chrome OS, and the GlobalProtect UWP app are not affected by this vulnerability.

Critical Impact

Local privilege escalation to root (macOS/Linux) or NT AUTHORITY\SYSTEM (Windows) enables attackers to gain complete control over affected endpoints, potentially compromising sensitive enterprise data and network resources.

Affected Products

• Palo Alto Networks GlobalProtect™ App on Windows
• Palo Alto Networks GlobalProtect™ App on macOS
• Palo Alto Networks GlobalProtect™ App on Linux

Discovery Timeline

• July 9, 2025 - CVE-2025-0141 published to NVD
• July 10, 2025 - Last updated in NVD database

Technical Details for CVE-2025-0141

Vulnerability Analysis

This vulnerability stems from an incorrect privilege assignment issue (CWE-426: Untrusted Search Path) within the GlobalProtect application. The flaw allows locally authenticated users without administrative privileges to exploit the application's trust in certain execution paths to escalate their privileges to the highest level available on the operating system.

The local attack vector means an adversary must have prior access to the target system, either through valid credentials, malware, or physical access. Once local access is obtained, the attacker can leverage this vulnerability to escalate from a standard user account to root privileges on Unix-like systems (macOS and Linux) or NT AUTHORITY\SYSTEM on Windows—the highest privilege level on these respective platforms.

The cross-platform nature of this vulnerability significantly increases its impact, as organizations typically deploy GlobalProtect across heterogeneous environments including Windows workstations, macOS endpoints, and Linux systems.

Root Cause

The root cause of this vulnerability is an untrusted search path issue (CWE-426) in the GlobalProtect application. The application improperly assigns privileges or fails to properly validate the execution path, allowing a local user to inject or manipulate executables or libraries that the GlobalProtect service loads with elevated privileges.

This type of vulnerability typically occurs when a privileged process searches for executables or DLLs in directories that can be modified by unprivileged users, or when the application does not properly validate the integrity of components it loads during execution.

Attack Vector

The attack requires local access to an affected system where the vulnerable GlobalProtect application is installed. An attacker with standard user credentials can exploit the untrusted search path to execute arbitrary code with elevated privileges.

On Windows systems, this could involve DLL hijacking or manipulating the search path to load malicious code when the GlobalProtect service executes. On macOS and Linux systems, similar techniques involving library injection or path manipulation could be used to achieve root-level code execution.

The exploitation does not require user interaction beyond the attacker's initial access, making it particularly dangerous in environments where users have local access to their endpoints but should be restricted from administrative functions.

Detection Methods for CVE-2025-0141

Indicators of Compromise

• Unexpected processes running with SYSTEM or root privileges that were spawned by GlobalProtect components
• Modifications to GlobalProtect installation directories or configuration files by non-administrative users
• Anomalous DLL or library loading patterns associated with GlobalProtect service processes
• Creation of suspicious files in directories within the GlobalProtect search path

Detection Strategies

• Monitor for privilege escalation attempts involving GlobalProtect processes using endpoint detection and response (EDR) solutions
• Implement file integrity monitoring on GlobalProtect installation directories to detect unauthorized modifications
• Alert on unusual process creation chains where GlobalProtect parent processes spawn unexpected child processes with elevated privileges
• Review Windows Event Logs for service control manager events and process creation events involving GlobalProtect components

Monitoring Recommendations

• Enable detailed process auditing on endpoints running GlobalProtect to track process creation and privilege changes
• Configure SentinelOne's behavioral AI to detect privilege escalation patterns associated with VPN client software
• Establish baseline behavior for GlobalProtect processes and alert on deviations indicative of exploitation attempts
• Monitor for lateral movement attempts following potential privilege escalation on GlobalProtect-enabled endpoints

How to Mitigate CVE-2025-0141

Immediate Actions Required

• Review the Palo Alto Networks Advisory for specific patch information and apply updates immediately
• Audit all systems running GlobalProtect App on Windows, macOS, and Linux to identify vulnerable installations
• Implement enhanced monitoring on affected endpoints until patches can be deployed
• Restrict local user access on sensitive systems where possible to reduce the attack surface

Patch Information

Palo Alto Networks has released a security advisory addressing this vulnerability. Organizations should consult the official Palo Alto Networks Security Advisory for CVE-2025-0141 to obtain the latest patched versions of the GlobalProtect App for all affected platforms.

Administrators should prioritize patching based on the criticality of systems and the organization's risk tolerance, with particular attention to systems containing sensitive data or with privileged network access.

Workarounds

• Implement strict access controls to limit which users can log in locally to systems running GlobalProtect
• Use application whitelisting to prevent unauthorized executables from running in GlobalProtect directories
• Configure file system permissions to prevent non-administrative users from modifying directories in the GlobalProtect search path
• Consider deploying additional endpoint protection solutions to detect and block privilege escalation attempts

# Example: Restrict permissions on GlobalProtect installation directory (Windows)
# Run in elevated PowerShell
icacls "C:\Program Files\Palo Alto Networks\GlobalProtect" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F" /grant:r "Users:(OI)(CI)RX"

# Example: Restrict permissions on GlobalProtect installation directory (Linux)
# Ensure only root can modify GlobalProtect directories
sudo chown -R root:root /opt/paloaltonetworks/globalprotect
sudo chmod -R 755 /opt/paloaltonetworks/globalprotect